Concessionary Bus Passes City of York Council Internal Audit Report 2017/18

Business Unit: Economy and Place Responsible Officer: Director, Economy & Place Service Manager: Head of Transport, Parking, Major Transport Projects Date Issued: 8/12/2017 Status: Final Reference: 10670/002

| | P1 | P2 | P3 | |---|----|----|----| | Actions | 0 | 0 | 7 | | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons eligible on grounds of age or disability. City of York Council (CYC) is the Travel Concession Authority (TCA) for the York area and is responsible for issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating within the city's boundaries.

CYC is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for cross-boundary journeys that originate in York. NYCC charges CYC for these journeys. Payments to BOCs and NYCC total nearly £4.2 million per annum, the majority of which is paid to First York. There are around 40,000 active passes issued by CYC, of which 36,000 are age-related and 4,000 disability-related.

The audit built upon work undertaken in the 2016-17 audit (final report attached at Annex 2). It focused on the methods used by First York and NYCC in data collection and processing, as well as analysing heavily-used passes for possible misuse.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that:

- The data processing methods used by First York were reliable and produced accurate returns;
- The data processing methods used by NYCC were reliable and produced accurate returns.

The audit also included analysis of heavily-used passes for evidence of possible misuse, building upon previous work performed in relation to hot-listing of passes.

Key Findings It was found that data processing at First York is largely automated, with little manual intervention. There are checks in place to ensure that data is downloaded from Electronic Ticket Machines (ETMs). However, there does not appear to be any control totals or checks to confirm that the data has transferred correctly and completely between First's three computer systems that are used to produce the monthly return. This is explained in more detail in Finding 1 below.

Analysis of NYCC's data processing methods found that they require manual inputs from staff as data is copied from operator returns to a 'master' spreadsheet showing all routes and to their finance system. Currently, reconciliation with Host Operator Processing System (HOPS) is not possible due to incomplete HOPS data. Veritau is currently carrying out a similar audit at NYCC and it is likely that an action will be agreed that they reconcile the operator returns, ‘master’ spreadsheet and finance system, and also implement reconciliations with HOPS. Implementation of these actions will provide more assurance regarding the accuracy of NYCC’s data processing. Updates on the operation of routes that CYC pays for are requested from CYC by NYCC staff on an ad-hoc basis. In order to ensure accurate payments are made by CYC, this should be carried out on a regular basis as explained in Finding 2 below.

Overall, there are no significant concerns regarding the data processing methods used by First or NYCC. Furthermore, the actions proposed as a result of the audit at NYCC should improve processes there. However, it was apparent that neither First nor NYCC conduct detailed checks on the accuracy and reliability of data returns to CYC specifically. This reinforces the importance of CYC having robust checks of the data returns it receives from First and NYCC. An action was agreed in respect of these checks in the 2016-17 audit and a further action has been raised at Finding 1 below.

Pass usage data for 2016-17 was analysed for trends, possible misuse and data quality. Of around 160,000 passes used in York, around 70% were used 10 times or less. By comparison, only 74 were used to make more than 1000 trips during the year. As CYC has around 40,000 active passes, it is assumed that the other 120,000 passes were issued by other TCAs. The low average usage likely reflects York's popularity as a tourist destination. In other words, visitors are using their passes to make a small number of trips while visiting the city.

The most significant finding of the analysis was that disabled pass holders, who make up 10% of all pass holders, were disproportionately represented in the top 20 most heavily-used passes (11/20), suggesting they make more frequent use of their passes than people eligible due to age. Two disabled pass holders in the top 20 were using passes that were hot-listed (marked as no longer valid) in 2013 and 2014 respectively, suggesting there may be more in use. Currently, hot-listing is not in effect, so the holders were able to continue using the passes, but there are plans to implement it in the near future. If this is done without any warning to pass holders, it may temporarily prevent disabled or vulnerable people from travelling freely on York buses.

Finally, other findings include limitations on the reporting capability of the card management systems, the wording of the bus pass application forms, and data quality issues relating to duplicate records and postcode entry.

**Overall Conclusions**

The arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Reconciliation of First York’s returns with HOPS figures

| Issue/Control Weakness | Risk | |------------------------|------| | Processes are mostly automated with little checking done to confirm accuracy of data. | Data is incorrect, leading to overpayments by CYC. |

Findings

First York’s systems are largely automated with little manual intervention. Data is automatically downloaded from ETMs and transferred in batches between the Depot Computer System, Central Computer System (CCS) and EP Morris system. A return is then produced from the EP Morris system by the Finance team and forwarded to CYC.

First check that the ETMs have sent the batch data and can check for corrupted data files in the CCS. However, there are no checks in place to confirm that the data is complete and accurate between the three systems. The HOPS system receives data directly from the ETMs, avoiding First’s computer systems.

Agreed Action 1.1

a) First’s returns will be reconciled to HOPS figures on an annual basis to check for accuracy and completeness. Any major discrepancies will be investigated.

b) The Public Transport team will seek a letter of assurance from First Group’s Internal Auditors as to the robustness of their data processing methods.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Sustainable Transport Manager | April 2018 | 2 Updates on CYC route changes

| Issue/Control Weakness | Risk | |------------------------|------| | Routes are incorrectly included or not included at all in the monthly data return. | Incorrect data may lead to incorrect payments by CYC. |

Findings

NYCC request updates from CYC on route changes, but this is on an ad-hoc basis. NYCC officers explained they are not always aware of route or timetable changes for CYC bus routes as their team focuses on NYCC routes.

The audit found that updates on discontinued routes had been provided by CYC. It was confirmed that no journey figures were provided for these routes in NYCC’s data returns, but the routes were still included in the returns. This, along with the ad hoc nature of the updates, limits the confidence that processes ensure returns are always accurate.

Agreed Action 2.1

a) CYC will provide an annual update on route changes to NYCC at the beginning of the financial year. NYCC will implement changes as a priority and confirm this with CYC.

b) CYC will provide updates to NYCC throughout the year as routes change or in response to data quality checks on the monthly returns.

These responsibilities will be included in the service agreement between the two councils. 3 Implementation of Hot-listing

| Issue/Control Weakness | Risk | |------------------------|------| | Implementation of hot-listing may cause problems for customers and an increased workload for CYC. | CYC may receive negative publicity in the press or complaints. There may also be a sudden increase in workload for Customer Services staff as pass holders try to get replacement passes. |

Findings

Analysis found that 20% of the top 20 passes were hot-listed, but had been used after they had been hot-listed. One was hot-listed in 2013 and the other in 2014, both of which were disabled passes. These two pass holders had not used their replacement passes. It is assumed that they found their lost passes and continued to use them instead. This suggests that there are more hot-listed passes being used, although exact numbers are not known (see Finding 4 below).

Currently, hot-listing is not in effect (which is why the pass holders were able to continue using their passes) as BOCs previously did not have the technology to implement it. This reflects the national position, few TCAs have implemented hot-listing, but CYC is now in a position to do so. However, implementing hot-listing without warning may temporarily deprive some pass holders, including people who are disabled or vulnerable, of their ability to travel freely on York buses until they get a replacement.

Agreed Action 3.1

A project plan will be developed for the implementation of hot-listing. This will include posting information regarding hot-listing on CYC’s website and in local newspapers and identifying and contacting pass holders who might be affected by the implementation, as well as actions 4.1-7.1 below.

| Priority | 3 | |----------|---| | Responsible Officer | Sustainable Transport Manager | | Timescale | April 2018 | 4 Reporting functionality in the new card management system

| Issue/Control Weakness | Risk | |------------------------|------| | The new card management system's reports do not include certain key fields. | Fraudulent pass usage cannot be detected. |

Findings

Limitations in the reporting functionality of Innovator (the old system) meant it was not possible to analyse the number of hot-listed passes still in use as a list of hot-listed passes could not be extracted.

The new card management system provided by ACT can produce lists of active and hot-listed cards broken down by card type (e.g. age, disability), but it cannot provide single complete lists of active or hot-listed passes. The reports also do not include certain key fields, such as hot-listing date and reason, the 16-digit ISRN or the issuing and expiry dates of the cards. Including these fields would make analysing pass usage and identifying possible fraudulent use more effective.

Agreed Action 4.1

The Public Transport team will review reporting functionality to determine if the fields identified above can be included.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Sustainable Transport Manager | April 2018 | 5 Data Quality in Innovator / ACT

| Issue/Control Weakness | Risk | |------------------------|------| | Data entered into the card management system is incorrect or incomplete. | Incorrect customer data may lead to passes being sent to the wrong address. |

Findings

Analysis was conducted on a list of approximately 40,000 active passes to look for issues in data quality or unusual entries.

Several hundred postcodes had been prefixed as ‘Y0’ or ‘Y)’ instead of ‘YO’ or had been left blank. Officers stated that the new card management system has an inbuilt postcode checker that will flag up incorrect postcodes. These should, therefore, have been corrected when pass holder data was uploaded to the new system.

A number of applicants had West Offices entered as their address. Customer Services indicated that occasionally this is allowed if the applicant has no fixed address. They have agreed to review these cases to ensure they are still suitable.

Agreed Action 5.1

a) Customer Services will review the customers with incorrect postcodes to ensure they are now correct.

b) Customer services will review customers who have West Offices listed as their address to ensure these are appropriate.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Customer & Resident Services Manager | April 2018 | 6 Duplicate Customer Records

| Issue/Control Weakness | Risk | |------------------------|------| | A small number of pass holders have been duplicated in the old card management system and issued with a second pass. | The passes may be used fraudulently by pass holders. |

Findings

There were 14 pairs of duplicate customer records in the previous card management system (Innovator). Each record had a different pass associated with it. There is, therefore, the potential for fraudulent use of these second passes; for example, pass holders could give them to family or friends to use instead.

The Public Transport team said that the new system should prevent further duplicate records being created and there is a duplicate checker built into the system.

Agreed Action 6.1

The Public Transport team will investigate the duplicate records and take appropriate action to prevent further use of the second passes by the pass holders. This may include investigating usage, contacting pass holders, and hot-listing the passes.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Sustainable Transport Manager | April 2018 | 7 Bus Pass Application Forms

| Issue/Control Weakness | Risk | |------------------------|------| | Bus pass application forms do not contain a clear statement about data protection or a declaration about proper use. | CYC is unable to prove intent during fraud investigations and applications do not comply with the Data Protection Act. |

Findings

Discussion with Veritau's Counter-Fraud team found that the bus pass application forms do not include a space for a signed declaration to the effect that applicants have provided true information, that they understand the terms of use, and that they will not use their pass for fraudulent gain. Best practice is for application forms to include such a statement. It also makes proving intent in cases of possible fraudulent use simpler for CYC.

It was also noted that the application forms do not make clear that applicants' personal data will be used in accordance with the Data Protection Act 1998 or that it will be shared with ACT.

Agreed Action 7.1

a) The Public Transport team will develop a declaration with advice from Veritau's Counter-Fraud team. b) The Public Transport team will develop a statement about data protection with advice from CYC's Information Governance team.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Sustainable Transport Manager | April 2018 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Concessionary Bus Passes City of York Council Internal Audit Report 2016/17

Business Unit: Economy & Place Responsible Officer: Director, Economy & Place Service Manager: Head of Transport, Parking, Major Transport Projects Date Issued: 31/5/2017 Status: Final Reference: 10670/001

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction The English National Concessionary Travel Scheme (ENCTS) was introduced in April 2008, providing free travel on local bus services to persons eligible on grounds of age or disability. City of York Council is the Travel Concession Authority (TCA) for the York area and is responsible for issuing bus passes, maintaining records relating to pass-holders, and reimbursing Bus Operating Companies (BOCs) for journeys originating within the city's boundaries.

The Council is also part of a joint concessionary fares scheme with North Yorkshire County Council (NYCC). NYCC reimburses BOCs for cross-boundary journeys that originate in York. NYCC charges the Council for these journeys. Payments to BOCs and NYCC total nearly £4.2 million per annum, the majority of which is paid to First York.

There are around 40,000 active passes issued by the Council, of which 36,000 are age-related and 4,000 disability-related. Data for January – May 2017 suggests the majority of passes are rarely used: 21,000 had been used for an average of less than one return journey per week and 10,000 had not been used at all. Of the other 9,000, fewer than 100 had been used to make more than 10 return trips per week in that period.

The audit considered the veracity of bus company claims for bus pass usage, as well as the issuance of bus passes and the accuracy of calculations for reimbursement. This was the first time that this area had been audited.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system ensured that:

- Bus passes were issued in line with criteria and up to date records are kept to minimise the risk of abuse or fraud;
- The data returns provided by BOCs and NYCC were reliable and accurate;
- Calculations for reimbursement were accurate and completed in a timely manner.

This audit included a visit to First Group because they are the main recipient of reimbursement from the Council.

Key Findings It was found that Customer Services staff understood and had access to the eligibility criteria for passes. The Innovator system, which is used for issuing and recording passes, has mandatory fields that must be completed before an application can be processed. These include the pass type, date of birth (for age-related passes) and a drop-down list of ‘evidence seen’ for disabled passes. The first significant issue is that although Innovator contains a ‘hot-listing’ function used for marking passes that are no longer valid, ‘hot-listing’ is not currently in effect. This means that passes barred on the Innovator system (for example, as lost or stolen) can still be used on buses to make journeys. Analysis identified three such passes still in use and a case of fraudulent use was reported to Veritau’s Counter-Fraud team during the audit. It should be noted, however, that officers are currently in the process of implementing a version of ‘hot-listing’, which will go some way to addressing the issue. Furthermore, ‘hot-listing’ has only been implemented by some TCAs nationally. This is raised in more detail in Finding 1 below.

Other findings related to issuing passes included that evidence for eligibility is not retained by Customer Services and that there is an available category of ‘none’ for ‘evidence seen’ that can be used when processing new applications. It was also found that Returns of Deaths have not been received from York Register Office for several months, so pass holders have not been marked as deceased.

Overall, analysis of data returns suggests they are generally reliable and that calculations for reimbursement are accurate. Comparison of the Electronic Ticket Machines (ETMs) and Host Operator Processing Systems (HOPS) data for First York routes found a discrepancy of 2.33% in the total trip figures for April - December 2016. Only one significant discrepancy was found in the NYCC figures (discussed below) and evidence was provided of other minor discrepancies being queried and resolved during the year.

The second major issue was a discrepancy in the trip figures provided by NYCC for May 2016 for two bus routes. These are more than double the average and represent a potential additional cost to the Council of over £20,000. Discussion with the Public Transport Planner found no obvious reason for such a discrepancy and it was agreed that further investigation is required. This is raised in more detail in Finding 2.

There is also no written guidance for carrying out ‘reasonableness’ checks on the data returns provided by First and NYCC. A visit to First York was also conducted during the audit. This established the guidance provided to drivers regarding bus passes and what reports are sent to the Council. However, the process for extracting data from ETMs and assembling the reports was not discussed in detail. There is an allocation of time in the 2017/18 audit plan that will be used for further work in this area.

Calculations for reimbursement were found to be accurate and completed in a timely manner. The purchase order for First York was properly authorised and there was an agreement in place for making advance payments, with monthly adjustments. These had been correctly calculated and paid. It was noted, however, that NYCC are not prompt in providing data returns and invoices, which meant that the purchase order for 2016/17 had not yet been raised at the time of the audit and an agreement on the amount owed had not been reached.

**Overall Conclusions**

The arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Implementation of 'hot-listing'

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | 'Hot-listing' is not currently in effect, which has led to fraudulent use of passes. | Passes are used fraudulently, leading to financial loss to the Council. |

Findings

It was known at the start of the audit that 'hot-listing' of passes currently was not in operation. Although passes can be 'hot-listed' on Innovator, this does not prevent them from being used on buses as it does not communicate with the smartcard readers.

Testing of 30 passes 'hot-listed' on Innovator found 3 to still be in use despite replacements being issued. There are around 2,500 active 'hot-listed' passes. This suggests, therefore, that around 10% of passes 'hot-listed' in 2016/17 may still be in use. As passes last for up to 5 years, the total number may be higher because passes 'hot-listed' as far back as 2012 may still be valid. Usage data for the 3 passes still in use has been analysed and no fraud is suspected.

Nevertheless, during the audit, a bus pass fraud case was referred to Veritau's Counter-Fraud team. A bus driver had confiscated two passes from a husband and wife when he noticed that the wife was using her husband's pass. Both passes were in the husband's name. The husband had been issued with a pass in September 2015, but reported it as not received. This was 'hot-listed' and he was sent a second pass in November 2015. Upon investigation, it was found that both passes had been used since then, with the couple making 55 duplicate trips between 15/3/2016 and 13/1/2017. The case is currently ongoing.

Officers have indicated that a version of 'hot-listing' will be implemented, which will go some way to reducing the risk. The new system will contain a 'warm-list' of suspect passes issued by the Council. When used, these passes will be moved to a 'hot-list' and will no longer be accepted. The system will not hold 'warm-lists' of passes from outside the York area due to technological limitations on the buses and because most TCAs have not implemented 'hot-listing'.

Agreed Action 1.1

'Hot-listing' will be implemented soon for the existing system and will be part of the new system.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------------| | 2 | Sustainable Transport Manager | September 2017 | 2 NYCC Data Return

| Issue/Control Weakness | Risk | |------------------------|------| | The trip figures for May 2016 for routes 840 and 843 require further investigation to determine their accuracy. | Trip figures provided by NYCC are inaccurate and are not thoroughly checked, leading to overpayments by the Council. |

Findings

Analysis of the data returns from NYCC identified two significant variations in trip numbers in May 2016. The figures for routes 840 and 843 were more than double their average for 2016/17 in May 2016. The routes had average monthly figures of around 8,500 and 11,600 respectively, but the figures for May were nearly 17,000 and 27,000 respectively. As the Rate Per Concession (RPC) for each route is £1, this represents a potential saving for the Council of over £20,000.

Discussion with the Public Transport Planner found no legitimate reason for such a variation and it was agreed that further investigation is required to ascertain if these figures are correct. Furthermore, the discussion also highlighted that less attention is given to checks on the NYCC data than First York data because NYCC is paid to carry out the administration on behalf of the Council. It may be advisable, therefore, to give the same level of attention to both sets of figures.

It should be noted that no payment has yet been made to NYCC because the final amount has not been agreed and this error may have been identified before payment was made. The Public Transport Planner is currently in discussion with NYCC about final trip figures and RPCs for different routes.

Agreed Action 2.1

The May 2016 data discrepancy will be queried with NYCC and payment will not be made until officers are confident that the May 2016 figures are accurate. ‘Reasonableness’ checks will be conducted to the same standard on returns from both NYCC and First York. Efforts will also be made to get data in a timely manner from NYCC.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 2 | Public Transport Planner | September 2017 |

### 3 Guidance on 'reasonableness' checks of data returns

| Issue/Control Weakness | Risk | |------------------------|------| | 'Reasonableness' checks are not documented. | 'Reasonableness' checks are not conducted, leading to overpayments by the Council. |

#### Findings

Discussion with the Public Transport Planner suggested that identifying discrepancies in trip figures from First York and NYCC relies on his experience and knowledge as there is no written guidance on carrying out reasonableness checks. Although no major discrepancies in First's data have been identified in the last year and only one significant discrepancy in NYCC's data has been identified during the audit, it may be advisable to compile written procedures on what checks to carry out should it become necessary for a less experienced person to conduct these checks.

#### Agreed Action 3.1

The Public Transport Planner will produce a document containing guidance on how data returns from First and NYCC can be checked for reasonableness.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Public Transport Planner | September 2017 | 4 Evidence of eligibility

| Issue/Control Weakness | Risk | |------------------------|------| | Evidence to support applications is not retained. | Ineligible applications are approved. |

Findings

Discussions with officers found that evidence of eligibility is not retained by officers once applications have been processed, despite Innovator having a document upload function. It is not possible, therefore, to confirm that applicants are eligible, although it should be noted that Customer Service staff were aware of their responsibilities and the evidence required is listed on the application forms. Copying and uploading documentation would provide greater assurance that applications are valid and confirm evidence has been seen.

Evidence of eligibility for disabled passes will be retained because evidence of disability has an expiry date and it is more likely there will be a need to refer to it. Despite the much greater number of age-related passes, age-related evidence will not be retained as it does not expire and it is much less likely there will be a need to refer back to it.

Agreed Action 4.1

Copies of evidence of eligibility for disability-related passes will be retained. Upon renewal, expired evidence will be removed and new evidence uploaded.

| Priority | 3 | |----------|---| | Responsible Officer | Customer & Resident Services Manager | | Timescale | September 2017 | 5 'Evidence seen' field on Innovator

| Issue/Control Weakness | Risk | |------------------------|------| | The Innovator system accepts 'none' as a valid category for 'evidence seen' when processing applications. | Ineligible applicants are issued with passes. |

Findings

Testing found that the Innovator system is designed in such a way that officers must enter certain details for applications to be approved. For disabled passes, it checks against a drop-down list of 'evidence seen'. This ensures that all relevant details are captured by the system. However, the 'evidence seen' field contains the valid category of 'none', which raises the possibility of applications being approved without valid evidence being seen. Although sample testing did not identify any that had 'none' as 'evidence seen', removing this category from the replacement system would prevent either accidental or deliberate use.

Agreed Action 5.1

The 'none' category will be removed from the evidence seen field as part of the new IT system. It will be ensured that only valid forms of evidence are included in this field.

| Priority | 3 | |----------|---| | Responsible Officer | Sustainable Transport Manager | | Timescale | September 2017 |

### 6 Guidance for bus drivers

| Issue/Control Weakness | Risk | |------------------------|------| | Guidance is in place, but it is not known if the guidance is followed. | Guidance on checking passes is not followed by drivers, allowing possible fraudulent use of passes. |

#### Findings

Discussions held with representatives from First York found that there is reasonable guidance in place for drivers regarding their responsibilities when checking concessionary bus passes. This discussion does not, however, confirm that the drivers are actually aware of and carrying out their responsibilities. Independent verification that drivers are doing so would provide more persuasive evidence than simply relying on the discussion held with First York. Incorporating a check into the surveys conducted by the Transport team would provide some evidence that guidance is followed.

#### Agreed Action 6.1

Checks that drivers are following the guidance will be incorporated into the bus surveys conducted by Council staff. There will also be a general review of the form used for the surveys.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Sustainable Transport Manager | September 2017 | 7 Return of Deaths

| Issue/Control Weakness | Risk | |------------------------|------| | Returns of Deaths are not being received from York Register Office, so pass holders are not being marked as deceased. | Pass holders are not marked as deceased, leading to fraudulent renewals or use of passes by other persons. Sending out renewal letters to deceased persons may also cause distress to families and harm the Council's reputation. |

Findings

Of 15 individuals on the most recent Return of Deaths list who were positively identified as holding bus passes, 12 of them had not been marked as deceased. Discussions with Customer Services established that they had not received a report from the Register Office for several months and they had not been chased up, which is why these individuals had not been marked as deceased.

A further 6 individuals could not be positively identified on Innovator because, although their names were on the system, they were registered at different addresses. The individuals may have moved house between receiving their bus pass and passing away. However, it is not possible to be sure about this without further information, such as a date of birth, which is not included in the report.

Currently, marking individuals as deceased only prevents them from receiving renewal letters. It does not stop the pass from working because 'hot-listing' is not in effect. Therefore, it is of limited value as a control because another related control does not work. Once 'hot-listing' is implemented, however, it will become more important to ensure that records are accurate so that this control is effective.

Agreed Action 7.1

Customer Services will liaise with the Register Office to ensure Returns are sent regularly. They will also discuss sending the Returns electronically and review the information in the report to ensure it is sufficient. Finally, the missing Returns will be acquired and Innovator records updated.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | Customer & Resident Services Manager | September 2017 | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.